espressif/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-04-27 19:13:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(protocomm): pass current session id when closing existing session

Browse Source 
sec1_new_session()/sec2_new_session() were calling sec*_close_session()
with the *new* session_id parameter instead of the existing
cur_session->id. The close handler validates `cur_session->id ==
session_id` before performing teardown, so the call always failed with
ESP_ERR_INVALID_STATE.

Effect: when a peer started a new provisioning session while another was
already active, the previous session's PSA keys, AES context, SRP handle
and username buffer were leaked instead of being destroyed. The cleared
session struct was overwritten by the new session, leaking the previous
key handles inside PSA Crypto and (for security2) leaking heap memory
for the username and SRP context.

Fix: pass cur_session->id so the close path actually executes the
teardown (psa_destroy_key/psa_cipher_abort/esp_srp_free/free) before the
new session takes over.
This commit is contained in:
Aditya Patwardhan
2026-04-14 11:05:51 +05:30
parent 1735ec860d
commit 9dc64a7402
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/protocomm/src/security/security1.c
+1 -1
View File
@@ -491,7 +491,7 @@ static esp_err_t sec1_new_session(protocomm_security_handle_t handle, uint32_t s
if (cur_session->id != -1) {
/* Only one session is allowed at a time */
ESP_LOGE(TAG, "Closing old session with id %" PRIu32, cur_session->id);
sec1_close_session(cur_session, session_id);
sec1_close_session(cur_session, cur_session->id);
}
cur_session->id = session_id;
components/protocomm/src/security/security2.c
+1 -1
View File
@@ -422,7 +422,7 @@ static esp_err_t sec2_new_session(protocomm_security_handle_t handle, uint32_t s
if (cur_session->id != -1) {
/* Only one session is allowed at a time */
ESP_LOGE(TAG, "Closing old session with id %" PRIu32, cur_session->id);
sec2_close_session(cur_session, session_id);
sec2_close_session(cur_session, cur_session->id);
}
cur_session->id = session_id;